Network Session Correlation for Malware Beaconing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious actors deploy malware in cloud computing platforms to gain illicit access, and the periodic nature of malware beaconing makes it difficult to distinguish from benign periodic activity, posing a challenge in detection.
Innovation Solution
A system and method for malware activity detection in networked computing systems using a machine learning model to analyze network and process session records, calculating correlation scores to identify potential malware activity and generate alerts, with mitigation operations to counteract the threat.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used to monitor network traffic, then detection simplicity is maintained, but detection precision deteriorates because malware beaconing periodicity resembles benign activity patterns
Solution Approach 1:
The detection system segments the analysis into multiple independent components: network session record analysis, process session record analysis, and correlation scoring. Each component processes specific aspects of the data independently, then results are combined to form a comprehensive detection decision, improving precision without proportionally increasing overall system complexity
Solution Approach 2:
The system transitions from analyzing single-dimension network traffic patterns to multi-dimensional analysis by incorporating both network session records and process session records. This dimensional expansion enables differentiation between malware and benign periodic activity through cross-dimensional correlation patterns
2Measurement precision
If multi-dimensional analysis is performed to distinguish malware from benign activity, then detection precision improves, but computational complexity increases
Solution Approach 1:
The system performs preliminary filtering and feature extraction on network and process session records before conducting correlation analysis. By pre-processing data to identify and extract relevant features, the system reduces the computational burden of subsequent multi-dimensional correlation calculations while maintaining detection precision
3Measurement precision
If correlation analysis between network and process records is performed, then detection precision improves, but processing time increases
Solution Approach 1:
The system extracts and focuses analysis on specific correlation scores between network session records and process session records, rather than performing exhaustive analysis of all possible data combinations. By extracting only the most relevant correlations, the system maintains high detection precision while reducing overall processing time
Data Source
AI summary
Malware activity detection for networked computing systems is described. A network session record is provided to a machine learning (ML) model configured to generate an indication of whether the provided network session record evidences malware activity. The network session record indicates network traffic activity in a time period. Responsive to an indication by the ML model, correlation scores are calculated by, for each process session record in a process session record set, calculating a correlation score indicative of a correlation between the provided network session record and the process session record. Each process session record in the process session record set corresponds to a process executed by a computing device in the time period. A determination that a correlation score indicates a corresponding process session record is indicative of the evidenced malware activity is made. Responsive to the determination, a malware activity alert is generated.